External Access

External Access

This document describes options for accessing the Kubernetes cluster's services from outside your local network.

Overview

There are two primary methods for providing external access to your cluster's services:

1. Cloudflare as a Reverse Proxy
2. Tor Hidden Services

Each method has its own advantages and use cases.

Cloudflare as a Reverse Proxy

Cloudflare can act as a reverse proxy for your services, providing additional security, caching, and DDoS protection.

Setup Steps

1. Register a Domain: If you don't already have one, register a domain name to use with Cloudflare

2. Add Domain to Cloudflare:

   • Create a Cloudflare account if you don't have one
   • Add your domain to Cloudflare and update your domain's nameservers

3. Configure DNS Records:

   • Create DNS records for each service you want to expose
   • Example: argocd.example.com → Points to your home IP address

4. Set Up Port Forwarding:

   • Configure your router to forward incoming traffic on ports 80 and 443 to your ingress controller's IP address (172.16.100.251)

5. Enable Proxy Status:

   • Enable the orange cloud (proxy) for each DNS record in Cloudflare

6. SSL/TLS Settings:

   • Set SSL/TLS encryption mode to "Full" or "Full (strict)"
   • Create origin certificates if using "Full (strict)"

7. Additional Security Rules (Optional):

   • Set up Cloudflare access rules to restrict access to specific countries or IP ranges
   • Configure Web Application Firewall (WAF) rules

Benefits

• DDoS Protection: Cloudflare absorbs attack traffic
• Caching: Improves performance for static content
• TLS Termination: Handles SSL/TLS encryption
• Hide Origin IP: Your home IP is not directly exposed
• Analytics: Provides insights on traffic

Tor Hidden Services

Tor hidden services (onion services) provide an alternative way to access your services with enhanced privacy and without requiring port forwarding or a public IP address.

Setup Steps

1. Install Tor:

   apt update && apt install -y tor

2. Configure Tor as a Hidden Service:

   • Edit /etc/tor/torrc:

   HiddenServiceDir /var/lib/tor/hidden_service/
   HiddenServicePort 80 172.16.100.251:80
   HiddenServicePort 443 172.16.100.251:443
   

3. Restart Tor:

   systemctl restart tor

4. Get Your .onion Address:

   cat /var/lib/tor/hidden_service/hostname

5. Access Services:

   • Use the Tor Browser to access your services via the .onion address

Benefits

• No Port Forwarding: Works behind NAT without port forwarding
• No Public IP Required: No need for a static IP or dynamic DNS
• Enhanced Privacy: Traffic is encrypted and routed through the Tor network
• Access Control: The .onion address is difficult to discover without sharing it

Combining Both Methods

You can implement both methods simultaneously to provide different access options for different scenarios:

• Use Cloudflare for general access, especially for services that benefit from caching
• Use Tor hidden services for more private access or as a backup method

Security Considerations

Regardless of the access method, consider these security measures:

1. Authentication: Implement strong authentication for all exposed services
2. Regular Updates: Keep your cluster and applications updated
3. Access Logs: Monitor access logs for suspicious activity
4. Rate Limiting: Implement rate limiting to prevent brute force attacks
5. Ingress Rules: Only expose services that need external access

Troubleshooting

Cloudflare Issues

1. SSL/TLS Errors:

   • Verify SSL/TLS mode is set correctly
   • Check certificate validity

2. DNS Propagation:

   • DNS changes may take time to propagate
   • Use dig or online DNS lookup tools to verify

Tor Issues

1. Connection Refused:

   • Verify the Tor service is running
   • Check if the specified ports are correctly routed to your ingress controller

2. Slow Connections:

   • Tor networks can be slower than direct connections
   • This is normal and expected

Further Reading

• Cloudflare Documentation
• Tor Project Documentation